Is workflow inbox empty for all users?  What is the output of [1]?[1]  http://<host>:<port>/libs/cq/workflow/content/inbox.infinity.json

Verify your permission settings. 

Verify your vlt filter.xml & pom.xml should work.  Otherwise file daycare with list of hotfix installed

Refer [1] to get an idea.[1]   http://aemfaq.blogspot.com/2013/04/cq5-package-filter-includeexclude.html

There is no limit. Offcourse keep minimum for easy managing & classification.  How many groups member list you are targeting here?If you have added  AD_Group into another AD_Group at CQ then you might loose if you have configured auto sync of group.   To avoid it add Group at ldap level only. 

Seems like a documentation bug. Please file a daycare ticket.

Configure vanity url with /health/heartbeat

For use case You can use existing page [1] for it depending on aem version.[1]  http://<host>:<port>/libs/cq/core/content/login.htmlhttp://<host>:<port>//libs/granite/core/content/login.html

What is your usecase? Seems something not correct to have everyone access for few pages at author instance. However along with permission You need to select "Allow Anonymous Access" at http://localhost:4502/system/console/configMgr/org.apache.sling.engine.impl.auth.SlingAuthenticator

Please follow the documentation [1].  It will let you update content to a central location no matter which page includes that.[1] http://dev.day.com/docs/en/cq/current/developing/boilerplates.html